Malicious PDF — malware analysis report

Static analysis result for SHA-256 51d6bc246b1f5944…

MALICIOUS

PDF

75.7 KB Created: 2021-03-23 12:36:13 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ed59bf0dbe717cebbf5b9d1f1d668771 SHA-1: dd5c2f12ee4a41fd79020461755ce52d8ffbbe3c SHA-256: 51d6bc246b1f59445a2482e4894bad23c58b6f1845a5f27f0a760c9a2e904a51
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by multiple heuristics and an ML classifier. It contains invisible links that redirect to suspicious domains, a common tactic for phishing or distributing further malware. The presence of external URIs and the overall detection by ClamAV as Pdf.Phishing.Trojan indicate a malicious intent to deceive or infect the user.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-heavy PDF with invisible link to suspicious domain high PDF_SUSPICIOUS_LINK_LURE
    PDF is a small image-heavy lure with invisible link annotations that send the user to a suspicious high-risk-domain URI. This matches credential-phishing carriers where the visible document is only a prompt and the real collection flow happens on the linked website.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://dafemum.ru/strik?utm_term=descriptive+writing+style
    • https://cdn.sqhk.co/zudatona/jcibZih/balunesexijipubawima.pdf
    • https://cdn.sqhk.co/luwonowuwig/1Gjdsie/daily_planner_2020_template.pdf
    • http://securitycheckingbrowservkcom.xyz/how_to_reset_maint_light_on_2012_prius_v9x0ae.pdf
    • https://cdn.sqhk.co/wejafivelij/clXc0ie/nikon_photo_transfer_app_for_mac.pdf
    • https://cdn.sqhk.co/zakoduba/ibkibic/nyan_cat_live_wallpaper_iphone.pdf
    • https://cdn.sqhk.co/wibafozadil/jehghgK/kof_98_um_ol_characters_stats.pdf
    • https://cdn.sqhk.co/jupujezaxa/fidHhhS/66689789108.pdf
    • https://cdn.sqhk.co/dedomafub/jaggiea/zugokudamubomatewifira.pdf
    • http://store50off.info/nuledimumivebovuzobiro7pjai.pdf
    • https://cdn.sqhk.co/sirijunubi/iMpxH2j/31135667648.pdf
    • http://momsmall.space/94855107687dm0ja.pdf
    • https://cdn.sqhk.co/ruxukulalodi/drGpwgf/nail_salons_open_now_during_covid_19.pdf
    • https://cdn.sqhk.co/pulununese/ehigehi/draw_out_salve_for_ingrown_hair.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/pululusodogi/bexekofisamodadiw.pdf
    • http://wizifaj.rf.gd/arduino_mega_francais.pdf
    • https://s3.amazonaws.com/musoxifuvitalo/jammu_university_marksheet_of_b._ed.pdf
    • https://s3.amazonaws.com/dikobepibelun/interview_format_paper_example.pdf
    • https://s3.amazonaws.com/wovisak/baixar_jogos_de_luta_livre_para_android.pdf
    • https://s3.amazonaws.com/kugelilizibuwum/74048396602.pdf
    • http://dilalixurapa.epizy.com/tuguzefoxijuze.pdf
    • https://s3.amazonaws.com/wufujudisu/dodikudafeburevejaxifuwoz.pdf
    • https://s3.amazonaws.com/zizene/mepipawuvowujebo.pdf
    • https://s3.amazonaws.com/diwitapezu/sheep_dog_mask_template.pdf
    • https://s3.amazonaws.com/luborinizu/saltwater_swimming_pool_maintenance_guide.pdf
    • https://s3.amazonaws.com/kitakilesa/6578872195.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eaf2.bin
2f7549908a215f13f9e5e7c99080378015cf5d3128955e4f73863f640d67b6c4		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEAF2 5144 bytes
font_01_sfnt_off0000fcac.bin
a0bd3db08d465d4e67e2fa9d627daed029995f559830b2cc1fba28d3bc4f23dc		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFCAC 10164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.